List certs = certPath.getCertificates();
X509Certificate cert = (X509Certificate)certs.get(index);
//
// (g) handle the name constraints extension
//
NameConstraints nc = null;
try
{
ASN1Sequence ncSeq = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert,
RFC3280CertPathUtilities.NAME_CONSTRAINTS));
if (ncSeq != null)
{
nc = NameConstraints.getInstance(ncSeq);
}
}
catch (Exception e)
{
throw new ExtCertPathValidatorException("Name constraints extension could not be decoded.", e, certPath,
index);
}
if (nc != null)
{
//
// (g) (1) permitted subtrees
//
GeneralSubtree[] permitted = nc.getPermittedSubtrees();
if (permitted != null)
{
try
{
nameConstraintValidator.intersectPermittedSubtree(permitted);
}
catch (Exception ex)
{
throw new ExtCertPathValidatorException(
"Permitted subtrees cannot be build from name constraints extension.", ex, certPath, index);
}
}
//
// (g) (2) excluded subtrees
//
GeneralSubtree[] excluded = nc.getExcludedSubtrees();
if (excluded != null)
{
for (int i = 0; i != excluded.length; i++)
try
{